Reviews
Part of A rigorous method for reviewing small business CRM products and services
Small business CRM selection checklist
A gated small business CRM selection checklist covering workflow, privacy, PECR, accessibility, security, migration and exit decisions.
Use this small business CRM selection checklist to reach a documented go, evidence request, remedy or stop decision. A candidate must pass every applicable mandatory gate. Do not average a privacy, security, accessibility or exit failure into a favourable feature score.
What to take away
- A candidate must pass every applicable mandatory gate, and a privacy, security, accessibility or exit failure cannot be averaged into a feature score.
- A supplier demo or feature page is not buyer-observed evidence, so tests need a precise environment and version.
- A CRM consent flag is evidence to examine, not a legal conclusion on lawful basis or electronic marketing.
- Unknown mandatory evidence means hold, not assumed acceptance, and each gate needs a source, owner and expiry date.
- The checklist does not certify compliance or suitability, so named specialists must review the actual use, data, messages and contract.
1. Decision and functional fit
- Name the decision owner, England operating scope, users, customer or prospect populations and decision date.
- Version the workflow, required events, state changes, outputs, exception paths and current baseline.
- Record the exact supplier, product, edition, region, seat or usage unit and applicable terms.
- Mark each requirement mandatory, tradeable or out of scope, with an evidence owner.
- Run identical synthetic tasks for import, assignment, update, duplicate, suppression, export and recovery.
- Capture configuration, tester role, expected result, actual evidence, defect, retest and stop condition.
No successful test should be described beyond its precise environment and version. A supplier demo or feature page is not buyer-observed evidence.
CRM-shaped fit is more than a generic workflow test. Examine contact and company records, deal pipelines and stages, email and calendar sync, sending limits and deliverability controls, per-seat billing and usage tiers, and the mobile app. Common small-business candidates include HubSpot, Zoho CRM, Pipedrive, Capsule and Freshsales; apply the same gates to each.
Decision and functional fit gates
- Name decision owner, scope, users, date
- Version workflow, events, outputs, baseline
- Record supplier, edition, region, seat unit
- Mark requirements mandatory, tradeable, out of scope
- Run synthetic tasksimport, update, export
- Capture configuration, evidence, defect, retest
2. Privacy and PECR
- Map personal data, purposes, sources, recipients, retention and deletion.
- Determine controller, joint-controller and processor roles from actual decisions rather than contract labels.
- Analyse lawful basis and transparency separately from electronic-marketing rules.
- Test objections, suppression and permission-state propagation without real customer data.
- Review tracking, pixels, integrations and international access as separate processing questions.
- Confirm ICO registration and fee status where your organisation or the supplier acts as a controller.
The ICO's controller and processor contract guidance describes mandatory contract areas where that relationship applies. Its direct marketing guidance explains consent, the soft opt-in and the risk of ICO fines for unlawful electronic marketing under PECR. The UK GDPR and the Data Protection Act 2018 set the lawful basis, transparency and data portability duties, and controllers must check ICO registration and fee status where required. A CRM consent flag is evidence to examine, not a legal conclusion.
Privacy and PECR checks
- Map personal data, purposes, retention, deletion
- Determine controller and processor roles
- Separate lawful basis from marketing rules
- Test objections and suppression without real data
- Review tracking, pixels, international access
3. Accessibility and security
- Define essential journeys for operators, administrators and any customer-facing forms.
- Examine the supplier's dated accessibility evidence and list uncovered journeys.
- Measure evidence against WCAG 2.2 AA and EN 301 549, and record any Equality Act 2010 duties that apply to your organisation.
- Include keyboard, screen-reader, zoom and error-recovery checks appropriate to users.
- Review identity, least privilege, logs, integration secrets, incident assistance and recovery.
- Record accreditation scope, date and exclusions without treating it as a blanket guarantee.
The W3C evaluation overview explains why automated and human methods have different roles. Measure the supplier's dated evidence against WCAG 2.2 AA and EN 301 549, and consider the Equality Act 2010 duties that apply to your organisation. Public sector bodies and suppliers to them should also note the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018. The NCSC cloud buyer guidance supports matching service evidence to the buyer's security needs. Qualified reviewers must assess the real configuration.
- Obtain a dated quote for the precise edition, quantities, currency, VAT basis, term and renewal.
- Identify implementation, integrations, support, training, internal labour and assurance costs.
- Review service description, change rights, sub-processors, incident support, audit, liability and termination.
- Give budget and contract owners separate approval authority and tolerances.
- Refuse to fill missing prices or limits with a different region, plan or supplier estimate.
4. Migration, support and exit
- Inventory fields, relationships, attachments, permissions, suppression, ownership and audit history.
- Reconcile record counts and exceptions after a synthetic migration rehearsal.
- Define support channels, clock rules, evidence, escalations and continuity workarounds in writing.
- Export a complete fixture in CSV and JSON, and test API-based export where available, then prove that an authorised person can restore or reuse it.
- Confirm data portability rights under the UK GDPR, deletion, residual copies, integration shutdown, account closure and evidence retention.
Record the outcome
For every gate, write pass, fail, unknown or not applicable, followed by source, owner and expiry date. Unknown mandatory evidence means hold, not assumed acceptance. The final record should identify the selected baseline or candidate, rejected alternatives, residual risks, conditions, rollback authority and recheck triggers.
This checklist does not certify compliance or suitability. Named privacy, PECR, security, accessibility, legal, commercial and finance specialists must review the actual use, data, messages, contract and sector before purchase or publication.
Before you act
- Name the decision owner, scope, users and decision date.
- Mark each requirement mandatory, tradeable or out of scope.
- Map personal data, purposes, sources, retention and deletion.
- Examine the supplier's dated accessibility evidence and uncovered journeys.
- Confirm the exact edition, seat or usage unit and renewal terms in writing.
- Rehearse a synthetic migration and reconcile record counts.
Common questions
What counts as acceptable evidence for a gate?
Evidence must come from buyer-observed tests run in a precise environment and version, not from a supplier demo or feature page. Each gate records pass, fail, unknown or not applicable, with source, owner and expiry date. Unknown mandatory evidence means hold, not assumed acceptance.
How should a CRM consent flag be treated?
The article says a CRM consent flag is evidence to examine, not a legal conclusion. Lawful basis and transparency must be analysed separately from electronic-marketing rules, and message, recipient and route all matter under PECR guidance. Objections, suppression and permission-state propagation should be tested without real customer data.
What should happen if prices or limits are missing?
Refuse to fill missing prices or limits with a different region, plan or supplier estimate. Obtain a dated quote for the precise edition, quantities, currency, VAT basis, term and renewal. Budget and contract owners should hold separate approval authority and tolerances before any purchase decision.
